How to Install Docker and Portainer on Ubuntu 25.10

This guide shows you how to install Docker Portainer on Ubuntu 25.10, then manage the Docker host through Portainer CE’s HTTPS dashboard in about ten minutes. Ubuntu 25.10 is archived now, so the package step uses Ubuntu’s preserved Questing repository and includes a safer SSH-tunnel workflow for the web UI.

Prerequisites

• A 64-bit Ubuntu 25.10 (Questing) VPS with at least 2 GB of RAM and 10 GB of free disk space for images, containers, and Portainer data.
• SSH access as root, or a regular Linux account with working sudo privileges.
• Outbound HTTPS access to the Ubuntu archive and Docker Hub.
• An SSH client on your workstation for the local port-forward. A domain is not needed for this private setup; you need one later for a public HTTPS reverse proxy.
• A VPSLake Linux VPS if you need a root-access Ubuntu server for Docker workloads.

Ubuntu 25.10 reached end of life in July 2026. The instructions below can still bring an existing Questing server online, but use Ubuntu 26.04 LTS for a new production deployment because archived packages do not receive normal security updates.

Step 1: Confirm Questing and refresh the archived package sources

Checking the release first prevents you from applying an archive workaround to the wrong Ubuntu version.

grep -E '^(PRETTY_NAME|VERSION_ID|VERSION_CODENAME|UBUNTU_CODENAME)=' /etc/os-release
dpkg --print-architecture
sudo sed -i -E 's#https?://[^[:space:]]*ubuntu\.com/ubuntu#http://old-releases.ubuntu.com/ubuntu#g' /etc/apt/sources.list.d/ubuntu.sources /etc/apt/sources.list 2>/dev/null || true
sudo apt update

The first commands should identify Questing and a supported 64-bit architecture. The sed command changes only Ubuntu’s standard source files to the archive host; it does not alter third-party repositories.

PRETTY_NAME="Ubuntu 25.10 (Questing Quokka)"
VERSION_ID="25.10"
VERSION_CODENAME=questing
amd64

If apt update reports that a repository has no Release file, do not replace questing with noble or another release. Follow the archive fix in Troubleshooting instead.

Step 2: Install Docker Engine and Compose v2 from Ubuntu

Docker’s official Ubuntu installation instructions list Ubuntu 22.04, 24.04, and 26.04, not 25.10. Ubuntu’s own docker.io and docker-compose-v2 packages are the release-matched option for an archived Questing host.

sudo apt install -y ca-certificates curl docker.io docker-compose-v2
sudo systemctl enable --now docker
sudo systemctl is-active docker
sudo docker version --format 'Client {{.Client.Version}} / Server {{.Server.Version}}'
sudo docker compose version

active means systemd started the daemon, and the version commands should print client/server and Compose v2 versions. Package revisions can differ from the example:

active
Client 29.x.y / Server 29.x.y
Docker Compose version v2.x.y

Run a small image to validate the daemon, registry access, and container runtime before adding Portainer:

sudo docker run --rm hello-world

Near the end, Docker prints Hello from Docker! and confirms that the installation is working. The test container exits immediately and is removed by --rm.

Step 3: Allow your SSH user to manage Docker

The Docker socket is root-owned by default, so adding one trusted account to the docker group removes repeated sudo prompts while keeping the daemon service unchanged.

Run this as the regular sudo-enabled account that will administer the VPS:

sudo groupadd --force docker
sudo usermod -aG docker "$USER"

Close the SSH session and reconnect so the new group membership is loaded. Then check the socket without sudo:

id -nG
docker info --format 'Server {{.ServerVersion}}'

The group list should contain docker, and the second command should print the Engine version. Membership is effectively administrative access, so do not add untrusted users to this group.

Step 4: Deploy Portainer CE with a persistent data volume

Portainer stores its users, settings, and environment configuration in a Docker volume; the volume lets you recreate the container without losing the dashboard configuration.

The command below uses the maintained LTS image and binds HTTPS to loopback. It does not publish Portainer to the public network, and port 8000 is omitted because it is only needed for Portainer Edge Agent features.

docker volume create portainer_data
docker run -d \
  --name portainer \
  --restart=always \
  --publish 127.0.0.1:9443:9443 \
  --volume /var/run/docker.sock:/var/run/docker.sock \
  --volume portainer_data:/data \
  portainer/portainer-ce:lts

Portainer’s official Docker installation guide uses the same server container, Docker socket mount, persistent volume, and HTTPS port. Portainer generates a self-signed certificate on first start, so a browser warning is expected for this initial local connection.

Step 5: Open the dashboard through an SSH tunnel

The loopback binding protects the administration panel from internet scans; an SSH tunnel carries only your workstation’s browser traffic to the VPS.

Run this command on your local workstation, not inside the VPS shell. Replace the placeholders with your SSH account and server address, then leave the terminal running:

ssh -N -L 9443:127.0.0.1:9443 YOUR_LINUX_USER@SERVER_IP

Open https://127.0.0.1:9443 in your browser. Accept the self-signed certificate warning for this private tunnel, create a strong unique administrator password, and choose Get Started on the initial setup page. The first setup window is time-limited, so complete it soon after starting the container.

Verify Docker and Portainer

These checks prove that Docker is enabled at boot, Portainer is running, its HTTPS listener answers locally, and the restart policy is configured:

systemctl is-active docker
systemctl is-enabled docker
docker ps --filter name=portainer --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}\t{{.Ports}}'
docker inspect --format '{{.HostConfig.RestartPolicy.Name}}' portainer
curl --insecure --head --max-time 10 https://127.0.0.1:9443

Expected output has an active, enabled daemon, one running Portainer container, always as the restart policy, and an HTTP success response:

active
enabled
NAMES      IMAGE                       STATUS       PORTS
portainer  portainer/portainer-ce:lts Up ...        127.0.0.1:9443->9443/tcp
always
HTTP/1.1 200 OK

Reconnect the SSH tunnel if you closed it, then reload https://127.0.0.1:9443 to confirm that the administrator account and local Docker environment are available in the UI.

Troubleshooting

404 Not Found or does not have a Release file

Questing has moved from the normal mirrors to Ubuntu’s old-release archive. Inspect the source URLs and rerun the archive conversion from Step 1:

grep -RInE '^(URIs?:|deb )' /etc/apt/sources.list.d/ubuntu.sources /etc/apt/sources.list 2>/dev/null
sudo sed -i -E 's#https?://[^[:space:]]*ubuntu\.com/ubuntu#http://old-releases.ubuntu.com/ubuntu#g' /etc/apt/sources.list.d/ubuntu.sources /etc/apt/sources.list 2>/dev/null || true
sudo apt update

The Ubuntu entries should point to old-releases.ubuntu.com and still use the questing suites. Do not mix packages from a different Ubuntu release.

Package 'docker-compose-v2' has no installation candidate

The universe component may not be enabled in the archived source configuration. Enable it, refresh APT, and repeat the package installation:

sudo apt install -y software-properties-common
sudo add-apt-repository -y universe
sudo apt update
sudo apt install -y docker.io docker-compose-v2

If the archive has been removed from your provider’s image, reinstall the VPS with a supported Ubuntu LTS release rather than installing packages built for Noble or Resolute on Questing.

permission denied while trying to connect to the Docker daemon socket

The current SSH process started before the docker group was added, or a different login account was modified. Reconnect, run id -nG, and retry docker info; use sudo docker info only as a temporary diagnostic.

The browser cannot connect to 127.0.0.1:9443

Portainer is intentionally listening only on the VPS loopback interface. Start the tunnel from your workstation and keep it open:

ssh -N -L 9443:127.0.0.1:9443 YOUR_LINUX_USER@SERVER_IP

On the VPS, sudo ss -ltnp | grep ':9443' should show a listener on 127.0.0.1:9443. Do not add a UFW rule for this private design; there is no public Portainer port to open.

Your Portainer instance has timed out for security purposes

Portainer stops a fresh instance if initial setup is not completed within its security window. Restart it, reconnect the tunnel, and finish account creation promptly:

docker restart portainer

If the message returns after a restart, check docker logs portainer and confirm that the portainer_data volume is still mounted. Do not delete the volume unless you intentionally want to start over.

Hardening

• Treat the Docker socket mount and docker group as root-equivalent administration. Keep SSH keys protected and remove group membership from accounts that no longer manage the host.
• Keep Portainer on loopback for administration through SSH. For team access, put it behind a domain, a reverse proxy with a trusted TLS certificate, authentication controls, and narrowly scoped firewall rules.
• Do not expose Docker’s unauthenticated TCP API on port 2375. Docker warns that published container ports can bypass ordinary UFW expectations, so review its packet-filtering and firewall guidance before publishing services.
• Back up the portainer_data volume before upgrades, and plan a move to Ubuntu 26.04 LTS because Questing is no longer receiving security updates.

FAQ

Can I use Docker’s official APT repository on Ubuntu 25.10?

Not as a supported release path. Docker’s current Ubuntu instructions list 22.04, 24.04, and 26.04, so this guide uses Ubuntu’s own archived packages instead. Rebuild or upgrade the VPS to a supported LTS release before relying on regular Docker updates.

Why does Portainer show a certificate warning?

A new Portainer CE installation creates a self-signed certificate for HTTPS on port 9443. The warning is expected when you connect through the private SSH tunnel; a public deployment should use a trusted certificate at a reverse proxy or provide a certificate through Portainer’s documented configuration.

Do I need to open port 8000 for this installation?

No. Port 8000 is for the TCP tunnel used by Edge Agents, and the local Docker environment in this guide uses the mounted Unix socket. Leaving it unpublished reduces the exposed surface.

Can I access Portainer directly from the internet?

You can, but a direct published Docker port needs deliberate network filtering because Docker’s forwarding rules may not behave like ordinary UFW rules. A domain, trusted TLS certificate, reverse proxy, authentication policy, and a restricted source-IP rule are safer than exposing the raw Portainer port.